No, it is not illegal to distribute malware by itself, but it is illegal to trick people into installing malware. The latter was the goal of the XZ contributor.
Some people would say that most drm software would act like malware/ransomware.
And tricking people to install such software is only matter of an ambiguously worded checkbox.